That misconfiguration is what triggered the investigation, but the investigation uncovered more severe problems, for example the municipality could not guarantee that private information was not transferred to unsafe countries.

Google have some setup where the data is stored in the EU (Ireland) and allegedly the encryption key is only available to the Ireland branch of Google and not the US branch. But the setup is still accessed by personnel from the US branch.